DF-5245 — pmap_extract() KVA path checks the PDE instead of the PTE

What

pmap_extract() (sys/platform/pc64/x86_64/pmap.c:1717-1769), kernel-address branch:

1733  pt = pmap_pt(pmap, va);              /* PD slot (pointer to PT entry) */
1734  if (pt && (*pt & pmap->pmap_bits[PG_V_IDX])) {   /* PDE valid */
1735      if (*pt & PG_PS) { ... 2MB case ok ... }
1737      else {
1738          ptep = pmap_pt_to_pte(*pt, va);          /* PTE slot */
1739          if (*pt & pmap->pmap_bits[PG_V_IDX]) {   /* BUG: re-tests *pt
                                                         (the PDE), should
                                                         test *ptep */
1740              rtval = *ptep & PG_FRAME;
1741              rtval |= va & PAGE_MASK;
1742          }
      }
  }

Line 1739 duplicates the PDE validity test instead of testing the PTE (*ptep). When the page-table page exists (PDE valid) but the PTE is 0 (page not entered / already removed), pmap_extract() returns (va & PAGE_MASK) — the page offset — as a "valid" physical address instead of 0 (its documented failure value).

Impact

Callers that use the return value without re-validating (e.g. _sglist_append_buf() in sys/kern/subr_sglist.c:126-160, which feeds ss_paddr straight into a scatter/gather list for DMA) can program a bogus low physical address into device I/O. On pc64 the KVA branch of pmap_extract() currently has no in-tree caller that passes a kernel VA (busdma uses pmap_kextract(); sglist user paths use the correctly-checked user branch at pmap.c:1756), so no live impact is demonstrated — filed as a Low-severity correctness landmine with certain code-level confidence.

Fix

--- a/sys/platform/pc64/x86_64/pmap.c
+++ b/sys/platform/pc64/x86_64/pmap.c
@@ -1736,7 +1736,7 @@
            } else {
                ptep = pmap_pt_to_pte(*pt, va);
-               if (*pt & pmap->pmap_bits[PG_V_IDX]) {
+               if (*ptep & pmap->pmap_bits[PG_V_IDX]) {
                    rtval = *ptep & PG_FRAME;
                    rtval |= va & PAGE_MASK;
                }

Verification

Not executed on the guest: the buggy branch is not reachable from any in-tree caller with a kernel VA on this platform (verified by grepping all pmap_extract call sites), so there is no runtime trigger to build — finding is certain by inspection, severity Low, no runtime impact demonstrated. No fix.diff beyond the one-liner above (also embedded here and in the finding markdown).